JP7229308B2 - Methods and systems for defending against universal adversarial attacks on time series data - Google Patents

Description

CROSS REFERENCE TO AND PRIORITY TO RELATED APPLICATIONS This application claims priority from Indian Patent Application No. 202021030571 filed on 17 July 2020.

TECHNICAL FIELD The present disclosure herein relates generally to cyber-physical security systems, and more particularly to methods and systems for assessing the impact of and defending against universal adversarial attacks on time-series data. Regarding.

As the world moves toward automation, extensive research is being conducted with the intention of automating various processes and systems. Machine learning is an important aspect when it comes to automation. Machine learning techniques learn patterns in data obtained from various processes and generate one or more data models that represent the processes. Such data models emulate the behavior of real processes and are therefore used for applications such as, but not limited to, industrial process optimization. However, attacks on such data pose data security problems. Moreover, such attacks can corrupt data, so using the corrupted data for other uses, such as optimization processes, may not have the intended result. For example, in the healthcare industry, ECG signals are important parameters that are measured to assess the health status of patients for diagnosing various diseases/disorders and the like. Appropriate therapy for the patient is determined based on analysis of such signals. However, if the ECG data is corrupted by an attacker using adversarial attacks, the identified assessment and treatment may not be adequate and may be fatal to the patient.

Embodiments of the present disclosure present technical improvements as solutions to one or more of the above-described technical problems recognized by the inventors in conventional systems. For example, in one embodiment, a processor-implemented method for defending against universal adversarial attacks is provided. Data from multiple data sources are received as inputs via one or more hardware processors. The received data is then preprocessed via one or more hardware processors. further, comparing the preprocessed data with training data in at least one data-driven model from the plurality of first set of data-driven models via one or more hardware processors; drift is determined. Further, regimes are identified that match the preprocessed data via one or more hardware processors. Further, via one or more hardware processors, data-driven models consistent with the identified regime are selected from the plurality of first set of data-driven models. Additionally, one or more universal adversarial attacks are performed against the selected data-driven model via one or more hardware processors. Performing one or more universal adversarial attacks involves computing universal adversarial perturbations in multiple iterations. Computing the universally adversarial perturbation further comprises computing an update for each of the plurality of first data samples from the data by taking an optimal step in the direction of the gradient of the loss for the corresponding data sample. Accompany. Additionally, the computed update is added to the previous value of the universal adversarial perturbation. The universal adversarial perturbation is then clipped after applying the computed update. Once the universal adversarial perturbations have been computed, the next step is to generate the selected data-driven model after performing one or more universal adversarial attacks via one or more hardware processors. performance is estimated. via one or more hardware processors, if the estimated performance of the selected data-driven model after executing one or more universally adversarial attacks is below the performance threshold; The selected data-driven model is retrained. Retraining of the selected data-driven model is performed on multiple second data samples using multiple data augmentation techniques and multiple adversarial attack techniques including generative models from a second set of data-driven models. wherein the plurality of second data samples has a distribution similar to the distribution of the first data samples, and in a further step, the plurality of first data samples and the plurality of is used in combination with the second data sample to update the selected data-driven model.

In another aspect, a system is provided for defending against universal adversarial attacks. The system includes one or more hardware processors, a communication interface, and a memory containing instructions. The instructions, when executed, cause one or more hardware processors to receive data from multiple data sources as inputs. The received data is then preprocessed via one or more hardware processors. further, comparing the preprocessed data with training data in at least one data-driven model from the plurality of first set of data-driven models via one or more hardware processors; drift is determined. Further, regimes are identified that match the preprocessed data via one or more hardware processors. Further, via one or more hardware processors, data-driven models consistent with the identified regime are selected from the plurality of first set of data-driven models. Additionally, one or more universal adversarial attacks are performed against the selected data-driven model via one or more hardware processors. Performing one or more universal adversarial attacks involves computing universal adversarial perturbations in multiple iterations. Computing the universally adversarial perturbation further comprises computing an update for each of the plurality of first data samples from the data by taking an optimal step in the direction of the gradient of the loss for the corresponding data sample. Accompany. Additionally, the computed update is added to the previous value of the universal adversarial perturbation. The universal adversarial perturbation is then clipped after applying the computed update. Once the universal adversarial perturbations have been computed, the next step is to generate the selected data-driven model after performing one or more universal adversarial attacks via one or more hardware processors. performance is estimated. via one or more hardware processors, if the estimated performance of the selected data-driven model after executing one or more universally adversarial attacks is below the performance threshold; The selected data-driven model is retrained. Retraining of the selected data-driven model is performed on multiple second data samples using multiple data augmentation techniques and multiple adversarial attack techniques including generative models from a second set of data-driven models. wherein the plurality of second data samples has a distribution similar to the distribution of the first data samples, and in a further step, the plurality of first data samples and the plurality of is used in combination with the second data sample to update the selected data-driven model.

In yet another aspect, a non-transitory computer-readable storage medium for defending against universal adversarial attacks is provided. A non-transitory computer-readable storage medium includes a plurality of instructions that, when executed, direct one or more hardware processors to a universal host using techniques detailed herein. to defend against physical attacks. Data from multiple data sources are received as inputs via one or more hardware processors. The received data is then preprocessed via one or more hardware processors. further, comparing the preprocessed data with training data in at least one data-driven model from the plurality of first set of data-driven models via one or more hardware processors; drift is determined. Further, regimes are identified that match the preprocessed data via one or more hardware processors. Further, via one or more hardware processors, data-driven models consistent with the identified regime are selected from the plurality of first set of data-driven models. Additionally, one or more universal adversarial attacks are performed against the selected data-driven model via one or more hardware processors. Performing one or more universal adversarial attacks involves computing universal adversarial perturbations in multiple iterations. Computing the universally adversarial perturbation further comprises computing an update for each of the plurality of first data samples from the data by taking an optimal step in the direction of the gradient of the loss for the corresponding data sample. Accompany. Additionally, the computed update is added to the previous value of the universal adversarial perturbation. The universal adversarial perturbation is then clipped after applying the computed update. Once the universal adversarial perturbations have been computed, the next step is to generate the selected data-driven model after performing one or more universal adversarial attacks via one or more hardware processors. performance is estimated. via one or more hardware processors, if the estimated performance of the selected data-driven model after executing one or more universally adversarial attacks is below the performance threshold; The selected data-driven model is retrained. Retraining of the selected data-driven model is performed on multiple second data samples using multiple data augmentation techniques and multiple adversarial attack techniques including generative models from a second set of data-driven models. wherein the plurality of second data samples has a distribution similar to the distribution of the first data samples, and in a further step, the plurality of first data samples and the plurality of is used in combination with the second data sample to update the selected data-driven model.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.

The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate exemplary embodiments and, together with the description, serve to explain the principles disclosed.

1 illustrates an exemplary system for defending against universal adversarial attacks, according to some embodiments of the present disclosure; FIG. 2B is a flow diagram illustrating the steps involved in the process of defending against a universally adversarial attack by the system of FIG. 1, according to some embodiments of the present disclosure (collectively referred to as FIG. 2B). 2A is a flow diagram illustrating the steps involved in the process of defending against universal adversarial attacks by the system of FIG. 1, according to some embodiments of the present disclosure (collectively referred to as FIG. 2A); 2 is a flow diagram showing the steps involved in the process of computing universal adversarial perturbation updates at each data point by the system of FIG. 1, according to some embodiments of the present disclosure; 1 illustrates an exemplary implementation of the system of FIG. 1 within an industrial plant environment for defending against universal adversarial attacks, according to some embodiments of the present disclosure; FIG.

Exemplary embodiments are described with reference to the accompanying drawings. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. Where convenient, the same reference numbers will be used throughout the drawings to refer to the same or like parts. Although examples and features of the disclosed principles are described herein, modifications, adaptations, and other implementations are possible without departing from the scope of the disclosed embodiments. It is intended that the following detailed description be considered as exemplary only, with a true scope being indicated by the following claims.

はXⁱに対応する敵対的サンプルである

は攻撃者がモデルに予測してほしいXⁱに対応する標的クラスである
ε_max∈RはXに対する許容される摂動のL_∞ノルムの上界である

はXⁱに対する許容される摂動のL_∞ノルムの上界である
f(.):R^T→R^Kは任意のデータ駆動型モデルである

はXⁱに対応するf(.)によって予測されるクラスである

はそれぞれ、非標的型攻撃および標的型攻撃に対する、サンプルXⁱ、データ駆動型モデルf(.)に対応する損失である
NはBIM(基本反復法(Basic Iterative Method))におけるステップの数である
α∈RはBIMの小さいステップサイズである
R_fooling∈Rは所望のフーリング比、すなわち、所与のデータセットからのだまされたサンプルの割合である
Epoch_foolはR_foolingを達成するために実行すべきエポックの最大数である
U∈R^TはデータセットXに対する普遍的敵対的摂動である

はFGSM(高速勾配符号法(Fast Gradient Sign Method))を使用したXⁱに対応する敵対的サンプルである
Error(.):はデータセットの誤分類エラー比を計算する。 Glossary:
A mathematical definition of the time series data classification problem addressed by the methods and systems herein is given below.
X ⁱ ∈R ^T is the i-th sample of dataset X and T is the sequence length of samples
Y ⁱ ∈[0,K-1], where Y ⁱ is the true class of the ith sample
K is the number of unique classes in X

is the adversarial sample corresponding to ^Xi

is the target class corresponding to X ⁱ that the attacker wants the model to predict ε _max ∈R is the upper bound on the L _∞ norm of the permissible perturbations on X

is an upper bound on the L _∞ norm of permissible perturbations on ^Xi
f(.):R ^T →R ^K is any data-driven model

is the class predicted by f(.) corresponding to ^Xi

are the losses corresponding to sample X ⁱ , data-driven model f(.) for untargeted and targeted attacks, respectively
N is the number of steps in BIM (Basic Iterative Method) α∈R is the small step size of BIM
R _fooling ∈ R is the desired fooling ratio, i.e. the fraction of fooled samples from a given dataset
Epoch _fool is the maximum number of epochs to run to achieve R _fooling
U∈R ^T is a universally adversarial perturbation on dataset X

is the adversarial sample corresponding to X ⁱ using FGSM (Fast Gradient Sign Method)
Error(.): computes the misclassification error ratio of the dataset.

Referring now to the drawings, and more particularly to FIGS. 1-4, wherein like reference numerals indicate corresponding features throughout the figures, preferred embodiments are shown and these implementations are shown. Aspects are described in the context of exemplary systems and/or methods below.

FIG. 1 shows an exemplary system (100) for defending against universal adversarial attacks, according to some embodiments of the present disclosure. FIG. 1 illustrates an exemplary system for experimental design and execution, according to some embodiments of the present disclosure. In one embodiment, the system 100 includes a processor 104, a communication interface device, alternatively referred to as an input/output (I/O) interface 106, and one or more data storage devices operably coupled to the processor 104 or and memory 102 . In one embodiment, processor 104 may be one or more hardware processors (104). In one embodiment, the one or more hardware processors (104) comprise one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuits, and/or operational It can be implemented as any device that manipulates signals based on instructions. Among other capabilities, processor 104 is configured to fetch and execute computer readable instructions stored in memory 102 . In one embodiment, system 100 may be implemented in various computing systems such as laptop computers, notebooks, handheld devices, workstations, mainframe computers, servers, network clouds, and the like.

The I/O interface 106 can include a variety of software and hardware interfaces, such as web interfaces, graphical user interfaces (GUIs), etc., and wired networks, such as LAN, cable, etc. and WLAN, cellular, or Multiple communications within a wide variety of network N/W and protocol types can be facilitated, including wireless networks such as satellites. In one embodiment, I/O interface 106 may include one or more ports for connecting several devices to each other or to another server. For example, I/O interface 106 allows authorized users to access the system disclosed herein through a GUI and communicate with one or more other similar systems 100 .

Memory 102 may be, for example, volatile memory such as static random access memory (SRAM) and dynamic random access memory (DRAM), and/or read only memory (ROM), erasable programmable ROM, flash memory, hard disks, optical disks, and/or May include any computer-readable storage medium known in the art, including non-volatile memory such as magnetic tape. Thus, memory 102 may contain information related to the inputs/outputs of each step performed by processor 104 of system 100 and the methods of the present disclosure. The various steps involved in the process of defending against universal adversarial attacks by system 100 are illustrated in FIGS. 2A-3 and described below with reference to the components of system 100. FIG.

2A and 2B (collectively referred to as FIG. 2) are flow diagrams illustrating the steps involved in the process of defending against universal adversarial attacks by the system of FIG. 1, according to some embodiments of the present disclosure.

The system 100 performs targeted attacks, untargeted attacks, and universal adversarial attacks on time-series data collected as input. System 100 is also configured to perform retraining of one or more data-driven models in response to targeted, untargeted, and universally adversarial attacks. To describe this process, the operation of system 100 within an industrial plant environment is considered, in which environment system 100 may be implemented as shown in FIG. However, the system 100 mitigates targeted, untargeted, and universally adversarial attacks against attacks, as well as data from any other application/environment, by following the techniques shown in FIGS. It should be noted that the system 100 may be configured to do so, and in such scenarios the system 100 may be implemented accordingly. The various data processing modules shown in FIG. 4 may be one or more hardware processor 104 implementations.

In this process, at step 202 the system 100 receives data from one or more data sources as input via the communication interface 106 . In various embodiments, the data can be real-time data as well as non-real-time data. For example, if the system 100 is used to perform targeted, non-targeted, and universally adversarial attack identification on data from an industrial plant, various process parameters (e.g., temperature, pressure, flow, levels, amounts of a particular material, etc.) are collected as real-time inputs, but information about parameters not available in real time, such as parameters measured or tested in the laboratory (e.g. chemical composition of substances/materials used). ) are collected as non-real-time inputs/data.

The system 100 then preprocesses the received input data using the data preprocessing module 401 at step 204 . Preprocessing the data involves identifying and removing outliers using one or more univariate and multivariate methods such as, but not limited to, "out-of-range detection", followed by imputation by the system 100. , and followed by synchronization and integration of multiple variables from one or more data sources. During the preprocessing stage, system 100 also uses one or more soft sensors in soft sensor estimation module 402 to estimate parameters that cannot be measured using physical sensors due to practical limitations. can interact. Soft sensors include physics-based and data-driven models that can derive required features and, optionally, derived feature values. The preprocessed data as well as the soft sensor data (ie, data derived using the soft sensors) are then stored in a suitable database within memory 102 for further processing. For purposes of explanation, the preprocessed data and soft sensor data stored in the database are collectively referred to as "preprocessed data."

Further, the system 100, at step 206, uses the drift detection module 403 to compare the training data in the at least one data-driven model from the plurality of first set of data-driven models to compare the previous Determine any drift in the processed data. The term "training data" in this context refers to reference data of plant operation and performance in terms of values for different process parameters, which are the expected/intended performance of the plant. The term "drift" in this context refers to the deviation of preprocessed data from the training data, indicating that plant performance and operating parameters do not match one or more expected levels. The drift detection module of system 100 includes one or more suitable multivariate outlier and drift detection methods such as, but not limited to, deep learning-based encoder-decoders, segregation forests, principal component analysis and one-class support vector machines. Determine the drift by analyzing the preprocessed data using . The system 100 may process the preprocessed data directly or after transforming the preprocessed data, and if drift is detected the system 100 may archive the data. In one embodiment, system 100 may perform labeling of archived data. System 100 may also provide an interface for authorized users to access system 100 and provide one or more inputs to assist in labeling of data. Data processed by system 100 may belong to one or more regimes. In one embodiment, at least one data-driven model set is generated for each regime and stored in a database in memory 102 . Each data-driven model set further includes a first set of data-driven models and a second set of data-driven models. Each data-driven model in the first set of data-driven models is trained to perform at least one time series modeling task, such as regression and classification. The first set of data-driven models includes, but is not limited to, regression variants (multiple linear regression, stepwise regression, forward regression, backward regression, partial least squares regression, principal component regression, Gaussian process regression, polynomial regression). ), decision trees and their variants (random forest, bagging, boosting, bootstrapping), support vector regression, k-nearest neighbor regression, spline fitting or its variants (e.g. multi-adaptive regression splines), artificial neural networks and their Variants (multilayer perceptrons, recurrent neural networks and their variants such as long short-term memory networks, and convolutional neural networks) and statistical, machine and deep learning techniques such as time series regression models can be constructed. In addition, the first set of data-driven models are statistics-based, machine-learning-based or deep-learning-based one-class or multi-class classification, scoring or diagnostic models such as principal component analysis, Mahalanobis distance, segregation forest, random Also included are forest classifiers, one-class support vector machines, artificial neural networks and their variants, elliptic envelopes and autoencoders (eg, dense autoencoders, LSTM autoencoders). Each data-driven model in the second set of data-driven models learns the distribution of data for the regime and produces data samples whose distribution matches the distribution of the training data for the corresponding regime, adversarial It is a generative model based on generative networks.

The system 100 has a database in memory 102 that is used to store information about different regimes, where the data belonging to each domain is specified. Further, at step 208, system 100 uses regime identification module 404 to process data preprocessed using one or more regime identification models in the model database in memory 102. identifies the regime of the current data point or batch of data points. By processing the preprocessed data, the system 100 identifies regimes that match the current data point or batch of data points. While identifying regimes consistent with preprocessed data, system 100 uses multiple data-driven regime identification models to determine whether the (preprocessed) input data belongs to the intended regime. or belong to global outliers. Data-driven regime discriminative models include random forest classifiers, support vector machine classifiers, artificial neural networks and their variants, as well as statistical techniques such as autoencoders (e.g. dense autoencoders, LSTM autoencoders), machine learning techniques and deep Contains models built using learning techniques. In one embodiment, if no matching regime is identified (i.e., no data matching the preprocessed data is found in any of the regimes), system 100 prompts an authorized user to define a new regime. A suitable interface can be provided.

Once a regime is identified (or a new regime is defined), the system 100, at step 210, generates a plurality of first models stored in a database in memory 102 as data-driven models consistent with the identified regime. Select a data-driven model (alternatively called a "model") from a set of data-driven models. In one embodiment, system 100 selects a data-driven model that matches each regime based on a mapping between data models and regimes. Each regime may be provided with a unique "regime ID", and each regime ID is then mapped with one or more data-driven models (e.g., "regime ID → data-driven model 'X'" ). Information regarding such mappings may be stored by the system 100 in a reference database. While processing real-time data, after identifying the regime to which the input data belongs, the system 100 identifies data-driven models that match the identified regime based on the data in this lookup table.

At step 212, system 100 performs at least one time series modeling task using the selected data-driven model. The time series modeling task can be at least one of regression, classification, anomaly detection, anomaly localization and prognosis. By performing at least one time series modeling task using the selected data-driven model, system 100 uses prediction module 408 to estimate various parameters associated with the observed process/system. Extract/predict values. Examples of such extracted/predicted parameter data include, but are not limited to, industrial process/machine health indices, estimated values of key performance indicators (KPIs), and the like. The step of performing time series modeling tasks for parameter prediction/extraction may be performed by system 100 in parallel with step 214 .

Additionally, at step 214, system 100 uses adversarial attack module 405 to perform one or more universal adversarial attacks against the selected data-driven model. In various embodiments, system 100 performs targeted as well as untargeted adversarial attacks against selected data-driven models. For example, the system 100 performs FGSM (Fast Gradient Coding) and BIM (Basic Iterative Method) attacks on selected data-driven models. Details of FGSM and BIM attacks are given below.

1. FGSM attack:
The FGSM attack is a single-step attack that generates adversarial samples by applying a perturbation X ⁱ in the direction of the sign of the 'gradient of loss' to the input. Alternatively, adversarial samples for non-targeted attacks are obtained by:

を予測するためにモデルを誤った方向に導く、標的型攻撃のための敵対的サンプルは以下によって取得される。 Target class to which the attacker corresponds to ^Xi

Adversarial samples for targeted attacks, which mislead the model to predict , are obtained by:

where L _T is equal to the negative of L. For targeted attacks, the loss between predicted and target classes is minimized, while for untargeted attacks, the loss between predicted and true classes is maximized. .

2. BIM attack:
In a BIM attack, FGSM is applied iteratively on the sample data by taking smaller step sizes and after each iteration the ^output is a constant is clipped to a value that is within prespecified limits of

は式(4)および(5)を使用して計算される。 Non-Targeted Adversarial Sample

is calculated using equations (4) and (5).

は方程式(6)および(7)を使用して計算される。 Similarly, targeted adversarial samples

is calculated using equations (6) and (7).

System 100 also performs a universal adversarial attack on the selected data-driven model, where the universal adversarial perturbation U for a given dataset X is It is defined to be able to mislead the most samples and is expressed in equation (8).

The universal adversarial perturbation is computed such that two conditions are satisfied: (a) the infinite norm of the perturbation is less than or equal to _εmax , and (b) the universal adversarial perturbation satisfies the desired Fooling ratio. These conditions are expressed as follows.

The above steps involved in the process of executing an adversarial attack against a selected data-driven model are illustrated in FIG. At step 302, the system 100 computes an update for each of the plurality of first data samples from the preprocessed data by taking the optimal step in the direction of the gradient of loss for the corresponding data sample. Additionally, at step 304, the system 100 adds the calculated update to the previous value of the universal adversarial perturbation. In the first iteration, the "previous value" of the universal adversarial perturbation refers to the initial value of the universal adversarial perturbation. In subsequent iterations, the "previous value" of the universal adversarial perturbation refers to the cumulative value of the universal adversarial perturbation at the end of the previous iteration. Additionally, at step 306, the output is clipped so that adversarial samples are within certain pre-specified limits.

が満たされることを確実にするために、ε_max無限ボールに対してU+ΔUの投影が取られる。 After performing such an adversarial attack on the selected data-driven model, system 100 uses model performance module 406 in step 216 to perform an adversarial attack on the selected data-driven model. Estimate the performance of selected data-driven models to assess impact. Some examples of parameters used by system 100 to evaluate the performance of data-driven models are accuracy, recall or true positive rate, false positive rate, false positive rate, overall accuracy, F-score, ROC (received receiver operating characteristic) area under the curve, mean square error (MSE), mean absolute error (MAE), root mean square error (RMSE), hit rate , including coefficients of determination, etc. In this step, U is computed by iterating over all samples in X while ignoring at least a few samples for which the predicted class is wrong. The system 100 is also configured to ignore at least a few "hard" samples in which the FGSM attack failed. For each of the remaining samples, ΔU with the minimum norm is computed by searching different step sizes in the direction of the loss gradient for each sample. Furthermore, the constraint

is satisfied, a projection of U+ΔU is taken on the ε _max infinite ball.

System 100 then compares the estimated performance of the selected data-driven model to a performance threshold. If the estimated performance of the selected data-driven model is below the performance threshold, at step 218 system 100 uses the selected data-driven model to overcome vulnerability to adversarial attacks. To update, a retraining module 407 is used to perform retraining of the selected data-driven model. At this stage, system 100 generates a plurality of second data samples using a plurality of data augmentation techniques and a plurality of adversarial attack techniques including generative models from a second set of data-driven models. The second data samples have a distribution similar to the distribution of the first data samples. Additionally, system 100 updates the selected data-driven model using a combination of the plurality of first data samples and the plurality of second data samples. System 100 performs adversarial training of the selected data-driven model at this stage. In one embodiment, system 100 trains all data-driven models on data corresponding to each regime using regime-specific training data, regime-specific augmented data and corresponding adversarial samples. to run. Training a data-driven model can involve changing the learning techniques and variables used in the model. For example, if the data-driven model chosen was a random forest classification model, techniques other than random forest, such as support vector machine classification and artificial neural network classification, may also be considered during retraining. To generate adversarial samples, system 100 uses the original regime-specific training data and the corresponding augmented data. For data augmentation of each regime-specific dataset, system 100 may use data generators trained using GANs, random masking and quantization, and the like. In random masking, the system 100 first assigns zero values to randomly selected instances and then interpolates those instances using one or more suitable univariate and multivariate interpolation algorithms. After random masking, system 100 first chooses a fixed number of levels between the minimum and maximum values of each univariate time series. Additionally, individual data point values within the time series data are rounded to the nearest level. By performing adversarial training on data-driven models for each regime, robust regime-specific adversarially trained data models that are difficult to fool can be obtained.

This written description describes the subject matter of this specification to enable any person skilled in the art to make and use the embodiments. The scope of the subject embodiments is defined by the claims, and may include other modifications that occur to those skilled in the art. Such other modifications, if they have like elements that do not differ from the claim language, or if they contain equivalent elements that do not differ materially from the claim language, It is intended to be within the scope of the claims.

Embodiments of the disclosure herein address an open issue of data security for time-series data used in data-driven models. Thus, the present embodiment identifies regimes that match given input data, selects the corresponding data-driven model, and performs a computation on the input data to mislead the selected data-driven model. Provides a mechanism for conducting universal adversarial attacks. Further, embodiments herein provide a mechanism for retraining the data-driven model when the estimated performance of the data-driven model due to attacks on the input data is identified as below a performance threshold. further provide.

The scope of protection extends to such programs and further to computer readable means having messages therein, and such computer readable storage means means that the programs are stored on a server or mobile device or any suitable programmable device. It should be understood to include program code means for implementing one or more steps of the method when operating. The hardware device can be any type of device that can be programmed including, for example, any type of computer such as a server or personal computer, or any combination thereof. The device may also include means which may be, for example, hardware means, which may be, for example, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or a combination of hardware and software means. , such as ASICs and FPGAs, or at least one memory with at least one microprocessor and software processing components disposed therein. Accordingly, the means may comprise both hardware and software means. The method embodiments described herein can be implemented in hardware and software. The device may also include software means. Alternatively, the present embodiments may be implemented on different hardware devices, for example using multiple CPUs.

Embodiments herein may include hardware and software elements. Embodiments implemented in software include, but are not limited to, firmware, resident software, microcode, and the like. The functions performed by various components described herein may be implemented in other components or combinations of other components. For purposes of this specification, a computer-usable or computer-readable storage medium includes, stores, communicates, or propagates a program for use by or in connection with an instruction execution system, apparatus, or device , or any device capable of transport.

The illustrated steps are presented to illustrate the illustrated exemplary embodiments, and it should be expected that ongoing technology developments will change the manner in which certain functions are performed. . These examples are presented herein for purposes of illustration and not limitation. Furthermore, the boundaries of functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternate boundaries may be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will become apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope of disclosed embodiments. Also, the terms "comprising," "having," "containing," and "including" and other similar forms are equivalent in meaning and Any one or more of the items followed by any one of them does not constitute an exhaustive list of such item or items, nor is it intended to be limited only to the listed item or items. It is intended to be open-ended in that there are no Also note that as used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural references unless the context clearly indicates otherwise. It must be.

Additionally, one or more computer-readable storage media may be utilized in implementing embodiments consistent with the present disclosure. Computer-readable storage medium refers to any type of physical memory in which information or data readable by a processor may be stored. Thus, a computer-readable storage medium may store instructions for execution by one or more processors, including instructions for causing the processors to perform steps or stages consistent with the embodiments described herein. . The term "computer-readable storage medium" is to be understood to include tangible items and exclude carrier waves and transients, ie, non-transitory. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, non-volatile memory, hard disks, CD ROMs, DVDs, flash drives, disks, and any other known physical storage medium. include.

It is intended that the present disclosure and examples be considered as exemplary only, with the true scope of the disclosed embodiments being indicated by the following claims.

100 systems
102 memory
104 processors
106 Input/Output (I/O) interfaces
200 processor implementation method
401 Data Preprocessing Module
402 Soft Sensor Estimation Module
403 Drift Detection Module
404 Regime Identification Module
405 Hostile Attack Module
406 model performance module
407 Retraining Module
408 Forecast Module

Claims (15)

A processor-implemented method (200) for defending against universal adversarial attacks, comprising:
receiving data from a plurality of data sources as input (202) via one or more hardware processors;
preprocessing (204) the received data via the one or more hardware processors;
of the preprocessed data compared to training data in at least one data-driven model from the plurality of first set of data-driven models, via the one or more hardware processors; determining (206) the drift in
identifying (208), via the one or more hardware processors, a regime that matches the preprocessed data;
selecting (210), via the one or more hardware processors, a data-driven model consistent with the identified regime from a plurality of first set of data-driven models;
performing (214), via the one or more hardware processors, one or more universal adversarial attacks against the selected data-driven model, comprising:
calculating the universally adversarial perturbation at multiple iterations, comprising:
calculating (302) an update for each of a plurality of first data samples from said data by taking an optimal step in the direction of a gradient of loss for the corresponding data sample in said training data;
adding (304) the calculated update to a previous value of the universal adversarial perturbation;
clipping (306) said universally adversarial perturbation after applying said calculated update; and step (214), comprising:
estimating (216), via the one or more hardware processors, the performance of the selected data-driven model after executing the one or more universally adversarial attacks;
the one or more hardware processors if the estimated performance of the selected data-driven model after executing the one or more universally adversarial attacks is below a performance threshold; retraining (218) the selected data-driven model via
generating a plurality of second data samples using a plurality of data augmentation techniques and a plurality of adversarial attack techniques including generative models from a second set of data-driven models; two data samples having a distribution similar to the distribution of the first data sample;
and updating said selected data-driven model using a combination of said plurality of first data samples and said plurality of second data samples. 2. The method of claim 1, wherein the preprocessing includes identifying and removing outliers, imputing missing data, and synchronizing and integrating multiple variables from one or more data sources. 2. The method of claim 1, wherein the drift in the preprocessed data is determined using multiple data-driven drift detection models. 2. The method of claim 1, wherein identifying the regime comprises using a plurality of data-driven regime identification models to determine whether the data belong to an intended regime or to a global outlier. the method of. A data-driven model set is generated for each regime, the data-driven model set comprising:
a first set of data-driven models, wherein the first set of data-driven models are trained to perform a time series modeling task;
a second set of data-driven models, wherein each data-driven model in said second set of data-driven models learns a distribution of data for said regime and a corresponding data-driven model for said regime; 2. The method of claim 1, comprising a second set of data-driven models that are generative adversarial network-based generative models that generate data samples that match the training data. 6. The method of claim 5 , wherein the time series modeling task is one of classification, regression, and anomaly detection tasks. 2. The method of claim 1, wherein the data collected as input is at least one of real-time data and non-real-time data. A system (100) for defending against universal hostile attacks, comprising:
one or more hardware processors (104);
a communication interface (106);
a memory (102) containing a plurality of instructions, wherein when the plurality of instructions are executed, the one or more hardware processors:
receiving data from multiple data sources as input (202);
preprocessing (204) the received data;
determining (206) drift in the preprocessed data compared to training data in at least one data-driven model from a plurality of first set of data-driven models;
identifying (208) a regime that matches the preprocessed data;
selecting (210) a data-driven model consistent with the identified regime from a plurality of first set of data-driven models;
performing (214) one or more universal adversarial attacks against the selected data-driven model,
Computing the universal adversarial perturbation at multiple iterations, comprising:
calculating (302) an update for each of a plurality of first data samples from the data by taking an optimal step in the direction of a gradient of loss for the corresponding data sample in the training data;
adding (304) the calculated update to a previous value of the universal adversarial perturbation;
clipping (306) the universally adversarial perturbation after applying the calculated update, performing (214) comprising:
estimating (216) the performance of the selected data-driven model after performing the one or more universal adversarial attacks;
the selected data-driven model if the estimated performance of the selected data-driven model after performing the one or more universal adversarial attacks is below a performance threshold; retraining (218), said retraining comprising:
generating a plurality of second data samples using a plurality of data augmentation techniques and a plurality of adversarial attack techniques including generative models from a second set of data-driven models; generating two data samples having a distribution similar to the distribution of the first data sample;
retraining (218) comprising: updating the selected data-driven model using a combination of the plurality of first data samples and the plurality of second data samples; Let it go, the system. 9. The system of claim 8, wherein the preprocessing includes identifying and removing outliers, imputing missing data, and synchronizing and integrating multiple variables from one or more data sources. 9. The system of claim 8, wherein the system determines the drift in the preprocessed data using multiple data-driven drift detection models. 9. The system of claim 8, wherein the system identifies the regime by determining whether the data belongs to an intended regime or to a global outlier using a plurality of data-driven regime identification models. system. A data-driven model set is generated for each regime, the data-driven model set comprising:
a first set of data-driven models, wherein the first set of data-driven models are trained to perform a time series modeling task;
a second set of data-driven models, wherein each data-driven model in said second set of data-driven models learns a distribution of data for said regime and a corresponding data-driven model for said regime; 9. The system of claim 8, comprising a second set of data-driven models that are generative adversarial network-based generative models that generate data samples that match the training data. 13. The system of Claim 12 , wherein the time series modeling task is one of a classification, regression, and anomaly detection task. 9. The system of claim 8, wherein the system collects at least one of real-time data and non-real-time data as input. 1. A non-transitory computer-readable storage medium for defending against universal adversarial attacks, said non-transitory computer-readable storage medium comprising a plurality of instructions, said plurality of instructions being executed, comprising:
receiving data from multiple data sources as input via one or more hardware processors;
preprocessing the received data via the one or more hardware processors;
of the preprocessed data compared to training data in at least one data-driven model from the plurality of first set of data-driven models, via the one or more hardware processors; determining drift in
identifying, via the one or more hardware processors, a regime that matches the preprocessed data;
selecting, via the one or more hardware processors, a data-driven model consistent with the identified regime from a plurality of first set of data-driven models;
executing one or more universal adversarial attacks against the selected data-driven model via the one or more hardware processors,
Computing the universal adversarial perturbation at multiple iterations, comprising:
calculating an update for each of a plurality of first data samples from the data by taking an optimal step in the direction of a gradient of loss for the corresponding data sample in the training data;
adding the calculated update to a previous value of the universal adversarial perturbation;
clipping the universally adversarial perturbation after applying the calculated update;
estimating, via the one or more hardware processors, the performance of the selected data-driven model after executing the one or more universally adversarial attacks;
the one or more hardware processors if the estimated performance of the selected data-driven model after executing the one or more universally adversarial attacks is below a performance threshold; retraining the selected data-driven model via
generating a plurality of second data samples using a plurality of data augmentation techniques and a plurality of adversarial attack techniques including generative models from a second set of data-driven models; generating two data samples having a distribution similar to the distribution of the first data sample;
updating the selected data-driven model using a combination of the plurality of first data samples and the plurality of second data samples; A non-transitory computer-readable storage medium.

Images